fix: correct tojson|safe usage in templates and update validator

- Remove |safe from |tojson in HTML attributes (x-data) - quotes must
  become " for browsers to parse correctly
- Update LANG-002 and LANG-003 architecture rules to document correct
  |tojson usage patterns:
  - HTML attributes: |tojson (no |safe)
  - Script blocks: |tojson|safe
- Fix validator to warn when |tojson|safe is used in x-data (breaks
  HTML attribute parsing)
- Improve code quality across services, APIs, and tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/admin/letzshop.py

@@ -68,7 +68,9 @@ def get_credentials_service(db: Session) -> LetzshopCredentialsService:
 def list_vendors_letzshop_status(
     skip: int = Query(0, ge=0),
     limit: int = Query(100, ge=1, le=1000),
-    configured_only: bool = Query(False, description="Only show vendors with Letzshop configured"),
+    configured_only: bool = Query(
+        False, description="Only show vendors with Letzshop configured"
+    ),
     db: Session = Depends(get_db),
     current_admin: User = Depends(get_current_admin_api),
 ):
@@ -119,8 +121,9 @@ def get_vendor_credentials(
         credentials = creds_service.get_credentials_or_raise(vendor_id)
     except CredentialsNotFoundError:
         raise ResourceNotFoundException(
-            "LetzshopCredentials", str(vendor_id),
-            message=f"Letzshop credentials not configured for vendor {vendor.name}"
+            "LetzshopCredentials",
+            str(vendor_id),
+            message=f"Letzshop credentials not configured for vendor {vendor.name}",
         )
 
     return LetzshopCredentialsResponse(
@@ -215,8 +218,9 @@ def update_vendor_credentials(
         db.commit()
     except CredentialsNotFoundError:
         raise ResourceNotFoundException(
-            "LetzshopCredentials", str(vendor_id),
-            message=f"Letzshop credentials not configured for vendor {vendor.name}"
+            "LetzshopCredentials",
+            str(vendor_id),
+            message=f"Letzshop credentials not configured for vendor {vendor.name}",
         )
 
     return LetzshopCredentialsResponse(
@@ -255,8 +259,9 @@ def delete_vendor_credentials(
     deleted = creds_service.delete_credentials(vendor_id)
     if not deleted:
         raise ResourceNotFoundException(
-            "LetzshopCredentials", str(vendor_id),
-            message=f"Letzshop credentials not configured for vendor {vendor.name}"
+            "LetzshopCredentials",
+            str(vendor_id),
+            message=f"Letzshop credentials not configured for vendor {vendor.name}",
         )
     db.commit()
 
@@ -445,7 +450,9 @@ def trigger_vendor_sync(
                         orders_imported += 1
 
                 except Exception as e:
-                    errors.append(f"Error processing shipment {shipment.get('id')}: {e}")
+                    errors.append(
+                        f"Error processing shipment {shipment.get('id')}: {e}"
+                    )
 
             db.commit()